registry / yaver-cli / 1.99.271

yaver-cli@1.99.271

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 164 KB of source, external domains: api.github.com, github.com, registry.npmjs.org, unpkg.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

2 "name": "yaver-cli",

3 "version": "1.99.271",

4 "mcpName": "io.github.kivanccakmak/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

13// 4. Build from the project's node_modules/react-native hermes

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

4// Pure JS packages — never need native code

5const PURE_JS_PACKAGES

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

9const { ensureAgentBinary, runAgentCommand } = require("./agent-runtime");

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

122if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L123: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L124: return; ... L130: } L131: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L132: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

10const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execSync } = require("child_process"); L12: const fs = require("fs"); ... L27: function envEnabled(name) { L28: const raw = String(process.env[name] || "").trim().toLowerCase(); L29: return raw === "1" || raw === "true" || raw === "yes"; ... L120: try { L121: if (process.platform !== "linux") return; L122: if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { ... L293: L294: const home = os.homedir(); L295: const rcFiles = [".bashrc", ".zshrc", ".profile"]

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/postinstall.jsView on unpkg · L10

Findings

5 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/hermesc-runtime.js

HighShell

HighSame File Env Network Executionsrc/hermesc-runtime.js

HighRuntime Package Installsrc/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/analyzer.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/postinstall.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

2 "name": "yaver-cli",

3 "version": "1.99.271",

4 "mcpName": "io.github.kivanccakmak/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

13// 4. Build from the project's node_modules/react-native hermes

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

4// Pure JS packages — never need native code

5const PURE_JS_PACKAGES

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

9const { ensureAgentBinary, runAgentCommand } = require("./agent-runtime");

Lines 102-142javascript

102 try {

103 await runAgentCommand(["mcp", "setup", target.client], { quiet: true });

104 configured.push(target.label);

105 } catch (error) {

106 log(`Skipping MCP setup for ${target.label}: ${error.message}`);

107 }

108 }

109 if (configured.length > 0) {

110 log(`Registered Yaver MCP in: ${configured.join(", ")}.`);

111 }

112}

113

114// ensureLinuxHermescBuildDeps installs the apt packages required to

115// compile hermesc from facebook/hermes sources on linux/arm64 (no

116// upstream prebuilt exists for that arch). Best-effort; only runs as

117// root. Mirrors ci/remote/install-hermesc.sh's dep list so the

118// outcome matches the Hetzner test-box bootstrap path.

119function ensureLinuxHermescBuildDeps() {

120 try {

121 if (process.platform !== "linux") return;

122 if (typeof process.geteuid !== "function" || process.geteuid() !== 0) {

123 log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually.");

124 return;

125 }

126 const required = ["git", "cmake", "ninja-build", "clang", "python3", "build-essential", "ca-certificates", "libicu-dev", "zlib1g-dev"];

127 if (!commandExists("apt-get")) {

128 log(`hermesc build deps missing (${required.join(", ")}) and no apt-get available. Install manually then re-run \`yaver install mobile\`.`);

129 return;

130 }

131 execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });

132 execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

133 stdio: "inherit",

134 });

135 log("Installed Linux hermesc build deps (cmake/ninja/clang/libicu-dev).");

136 } catch (error) {

137 log(`Skipping hermesc build deps install: ${error.message}`);

138 }

139}

140

141function ensureLinuxRunnerSandboxPackages() {

142 try {